fe3afd8049e44c33a0e781876023fd7e_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

fe3afd8049e44c33a0e781876023fd7e_JaffaCakes118
Size

151KB
MD5

fe3afd8049e44c33a0e781876023fd7e
SHA1

8a36b3e775ed27843bf9bbbff3f428ea9be45a79
SHA256

d62588e073c29cdae5b5a6c1efe191c0701c419da3c6269d9ee3e06c49547229
SHA512

5509437f3f98a88eede28fd02209b9cdc53090ec96a850ed59cbb2eef60379a90b01df49dc63abd45dfe998349ec6c19920b4d1fb92bf419b7f5c0d5f62e0b74
SSDEEP

3072:dJcN4BnNf0UMC4f1fui01tOM5NSspHFzdE+U68Okv5bIuke2QSgmzt42ISQf2LkS:dJciNMUi1fu/1vtPgxu/xzD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fe3afd8049e44c33a0e781876023fd7e_JaffaCakes118

Files

fe3afd8049e44c33a0e781876023fd7e_JaffaCakes118
.exe windows:1 windows x86 arch:x86

1e1f95cf434da402505443b4055e9ade

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

EnableWindow
GetDlgItem
SetWindowLongA
SetDlgItemTextA
GetDlgItemTextA
wsprintfA
SendDlgItemMessageA
LoadStringA
SetFocus
IsDlgButtonChecked
PostMessageA
GetMenu
GetSubMenu
GetMenuItemCount
SetMenuDefaultItem
GetClientRect
MapWindowPoints
TrackPopupMenuEx
LoadImageA
DestroyIcon
UnregisterClassA
MsgWaitForMultipleObjects
PeekMessageA
CheckDlgButton
GetWindowLongA
EndDialog
SendMessageA
IsWindow
GetForegroundWindow
SetTimer
SetForegroundWindow
PostQuitMessage
DialogBoxParamA
DestroyWindow
KillTimer
LoadIconA
LoadCursorA
LoadAcceleratorsA
GetMessageA
TranslateMessage
DispatchMessageA
TranslateAcceleratorA
FindWindowA
CreateWindowExA
RegisterClassA
DefWindowProcA
MessageBeep
SetDlgItemInt

kernel32

GetFileSize
GlobalAlloc
GetStartupInfoA
GetModuleHandleA
GetExitCodeThread
CreateDirectoryA
GetFileAttributesA
InterlockedDecrement
GetTickCount
InterlockedIncrement
WriteFile
CreateFileA
OpenProcess
ReadFile
LoadLibraryA
GetProcAddress
WritePrivateProfileStringA
lstrlenA
UnmapViewOfFile
MapViewOfFile
OpenFileMappingA
WaitForSingleObject
OpenEventA
ReleaseSemaphore
CreateThread
SetEvent
CreateFileMappingA
GetLastError
CreateMutexA
CloseHandle
OpenSemaphoreA
CreateSemaphoreA
GetCurrentProcessId
InitializeCriticalSection
DeleteCriticalSection
LocalFree
Sleep
lstrcatA
FreeLibrary
LeaveCriticalSection
EnterCriticalSection
FindClose
FindNextFileA
DeleteFileA
lstrcpyA
FindFirstFileA
LocalAlloc
GlobalFree
CreateEventA
TerminateThread
lstrcmpA
lstrcmpiA
GetDiskFreeSpaceA

advapi32

RegQueryValueExA
RegOpenKeyExA
RegDeleteValueA
RegDeleteKeyA
RegSetValueExA
RegCloseKey
RegOpenKeyA
RegCreateKeyExA

shell32

Shell_NotifyIconA

moscl

_OpenMOSSession@8
_InitMOS@8
_OpenMOSConnection@16
_CloseMOSSession@4
_CloseMOSConnection@4
_TerminateMOS@0

mcm

MosErrorExP
g_GuidePID
SetMosGlobalSetting
PBKSyncBackground
GetMosGlobalSetting
vhDlgCon
FGuideIsDead
FAskApps2Disconnect
FGetGoWord
MsgWaitForSingleObject
vMCMFailOpeningSession
vMCMError
FGetDeviceID
FCheckActiveSockets
HandleHelp
FIsMSNDialup
FInsureModemTAPI
IfTCPthenSecurityCheck
vMCMNeedSecurityReboot
ChangeConnectionSettings
FGetPortDetails
??0CAuthenticator@@QAE@PBD0HK@Z
?StAuthenticate@CAuthenticator@@QAE?AW4AuthStatus@@PAUIMosUniversal@@PAI@Z
vfInitMos
IfTCPthenUpdateOhare
MosErrorP
g_cOpenSessions
vfOnline
??1CAuthenticator@@QAE@XZ
LoadAndCallW
MCMCloseSession
FIsTCP

mosmisc

FRegistryKeyExists
SetRegistryRaw
FGetRegistryDword
FGetPreferenceBool
CenterDlg
PVReadRegSt
GetSz
DeleteRegistryValue
FWriteRegSt
FFindMSNFile

moscc

InitCustomControls

crtdll

_XcptFilter
_local_unwind2
_global_unwind2
strncmp
srand
memmove
exit
_exit
strcat
strchr
strcpy
strlen
memcpy
??3@YAXPAX@Z
memset
__GetMainArgs
_acmdln_dll
_initterm
_commode_dll
_fmode_dll
rand
??2@YAPAXI@Z

Exports

Exports

??4CAuthenticator@@QAEAAV0@ABV0@@Z
??_ECAuthenticator@@QAEPAXI@Z
??_FCAuthenticator@@QAEXXZ
??_GCAuthenticator@@QAEPAXI@Z
?FInitialized@CAuthenticator@@QAEHXZ
?PhContext@CAuthenticator@@QAEPAU_SecHandle@@XZ
SzExpandDataCenter

Sections

.text
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.CRT
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 346B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 59KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

1e1f95cf434da402505443b4055e9ade

Headers

File Characteristics

Imports

user32

kernel32

advapi32

shell32

moscl

mcm

mosmisc

moscc

crtdll

Exports

Exports

Sections

.text Size: 28KB - Virtual size: 28KB

.bss Size: - Virtual size: 3KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 2KB - Virtual size: 1KB

.idata Size: 5KB - Virtual size: 4KB

.CRT Size: 512B - Virtual size: 12B

.edata Size: 512B - Virtual size: 346B

.rsrc Size: 59KB - Virtual size: 59KB

.reloc Size: 52KB - Virtual size: 51KB

.text
Size: 28KB - Virtual size: 28KB

.bss
Size: - Virtual size: 3KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 1KB

.idata
Size: 5KB - Virtual size: 4KB

.CRT
Size: 512B - Virtual size: 12B

.edata
Size: 512B - Virtual size: 346B

.rsrc
Size: 59KB - Virtual size: 59KB

.reloc
Size: 52KB - Virtual size: 51KB